PHP 8.6 is three weeks out — here's what's shipping besides partial function application

I spent a post on PHP 8.6's partial function application footguns back on RC3, because that's the feature that reads exciting and bites you if you're not careful with it. With beta done (13 August 2026), hard feature freeze behind us (22 September 2026), and GA targeted for 19 November — per the PHP RFC wiki's 8.6 listing and the PHP Foundation's own release-schedule announcements — the feature list is locked. So here's what I'm actually planning to use starting day one, which turns out to be mostly the RFCs that didn't get a hype cycle.

The ones I'll reach for immediately

• Readonly property defaults. Readonly properties can finally declare a default value. This is the one I'm most directly glad about — Drupal's increasing use of readonly value objects and DTOs has meant writing out constructor assignments for properties that are, in practice, almost always the same default. Not a dramatic feature, but a real reduction in boilerplate for a pattern that's becoming more common, not less.
• Secure Session Configuration Defaults. Session-related ini defaults get hardened out of the box. Worth being precise about what this is: it's a defaults change, not a vulnerability fix — nothing was broken before, the insecure option was just something you had to actively opt out of rather than something you got automatically. Still a meaningful shift for anyone deploying PHP without having audited their session.* ini settings by hand.
• Duration class and clamp(). A proper value object for time spans, and a clamp($value, $min, $max) function in core — both small, both things I've hand-rolled or pulled in a dependency for more than once. Having them in core means one less utility class per project and one less thing to explain in a code review.

The ones that change how you debug, not how you write code

Debugable Enums improves how enum cases actually render in var_dump() and similar debug output — a quality-of-life fix for anyone who's stared at an unhelpful enum dump trying to figure out which case they actually got back. #[\Override] extended to class constants closes a gap in the attribute that already exists for methods: if a child class overrides a parent's constant, you can now mark that explicitly and have PHP verify the parent constant actually exists, the same safety net #[\Override] already gives you for method overrides.

One deprecation worth knowing about

Returning a value from __construct() or __destruct() is now deprecated. It never did anything useful — constructors and destructors aren't supposed to return anything meaningful to a caller — but PHP didn't previously warn you about it. If you've got a magic method somewhere with an accidental stray return statement, 8.6 is where that starts surfacing as a deprecation notice instead of silently doing nothing.

Why I'm writing about this instead of PFA again

Partial function application is the feature that'll get the launch-day blog posts and conference talk mentions, because it's new syntax and new syntax is interesting to write about. But readonly defaults, hardened session settings, and a Duration class in core are the kind of changes that quietly remove small amounts of friction from code I write every week, in a way PFA — genuinely useful as it is for the specific cases it fits — mostly isn't, for the kind of CMS and application code I actually spend my days in. Worth knowing both exist; worth being honest about which one changes more of your actual week.